tedkulp/PrivateBin
1
0
Fork 0
mirror of https://github.com/PrivateBin/PrivateBin.git synced 2026-03-05 13:30:32 -05:00
Code Issues Packages Projects Releases Wiki Activity

re-lax samesite cookie policy

Browse Source 
As per discussion in code review:

> Cookies are always scoped in browsers. That's not the issue. SameSite attribute just protects against CSRF attacks. But Get requests (aka links) are also "protected" with Strict, which breaks it… and for users that is highly confusing when they (apparently arbitrarily) do not get the language they have set before when clicking a link.

https://github.com/PrivateBin/PrivateBin/pull/1287#discussion_r1589299210
This commit is contained in:
El RIDO
2024-05-04 12:12:31 +02:00
parent 5425ea79f8
commit 81fdf8ebfc
6 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/Controller.php
View File

@@ -178,7 +178,7 @@ class Controller
// force default language, if language selection is disabled and a default is set
if (!$this->_conf->getKey('languageselection') && strlen($lang) == 2) {
$_COOKIE['lang'] = $lang;
setcookie('lang', $lang, array('SameSite' => 'Strict', 'Secure' => true));
setcookie('lang', $lang, array('SameSite' => 'Lax', 'Secure' => true));
}
}
@@ -389,7 +389,7 @@ class Controller
$languageselection = '';
if ($this->_conf->getKey('languageselection')) {
$languageselection = I18n::getLanguage();
setcookie('lang', $languageselection, array('SameSite' => 'Strict', 'Secure' => true));
setcookie('lang', $languageselection, array('SameSite' => 'Lax', 'Secure' => true));
}
// strip policies that are unsupported in meta tag